VulnerableCode Package Details - pkg:alpm/archlinux/thunderbird@78.9.0-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-3tmg-yvx8-5kdt Aliases: CVE-2021-23991	If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might subsequently attempt to use the invalid subkey, and will fail to send encrypted email to Alice.	78.9.1-1 Affected by 0 other vulnerabilities.
VCID-7tj1-s8bv-e7hv Aliases: CVE-2021-23992	Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent.	78.9.1-1 Affected by 0 other vulnerabilities.
VCID-un8e-mz4v-t7ea Aliases: CVE-2021-29949	When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been infected with a malicious library of the alternative filename, and the malicious library has been copied to a directory that is contained in the search path for executable libraries, then Thunderbird will load the incorrect library.	78.9.1-1 Affected by 0 other vulnerabilities.
VCID-yy95-yypj-cqbh Aliases: CVE-2021-23993	An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail.	78.9.1-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-3tmg-yvx8-5kdt
Aliases:
CVE-2021-23991

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might subsequently attempt to use the invalid subkey, and will fail to send encrypted email to Alice.

78.9.1-1
Affected by 0 other vulnerabilities.

VCID-7tj1-s8bv-e7hv
Aliases:
CVE-2021-23992

Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. An attacker may create a crafted version of an OpenPGP key, by either replacing the original user ID, or by adding another user ID. If Thunderbird imports and accepts the crafted key, the Thunderbird user may falsely conclude that the false user ID belongs to the correspondent.

78.9.1-1
Affected by 0 other vulnerabilities.

VCID-un8e-mz4v-t7ea
Aliases:
CVE-2021-29949

When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been infected with a malicious library of the alternative filename, and the malicious library has been copied to a directory that is contained in the search path for executable libraries, then Thunderbird will load the incorrect library.

78.9.1-1
Affected by 0 other vulnerabilities.

VCID-yy95-yypj-cqbh
Aliases:
CVE-2021-23993

An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. If an attacker creates a crafted OpenPGP key with a subkey that has an invalid self signature, and the Thunderbird user imports the crafted key, then Thunderbird may try to use the invalid subkey, but the RNP library rejects it from being used, causing encryption to fail.

78.9.1-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-a2x3-x693-gqdf	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-23984
VCID-gjvm-8v8y-d7c5	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-23982
VCID-kk9k-mpvr-7kh9	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-23981
VCID-uv8b-n94e-budc	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.	CVE-2021-23987

Vulnerability

Summary

Aliases

VCID-a2x3-x693-gqdf

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-23984

VCID-gjvm-8v8y-d7c5

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-23982

VCID-kk9k-mpvr-7kh9

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-23981

VCID-uv8b-n94e-budc

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which could result in the arbitrary execution of code.

CVE-2021-23987

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T18:26:47.107698+00:00	Arch Linux Importer	Affected by	VCID-3tmg-yvx8-5kdt	https://security.archlinux.org/AVG-1790	38.0.0
2026-04-01T18:26:47.083504+00:00	Arch Linux Importer	Affected by	VCID-7tj1-s8bv-e7hv	https://security.archlinux.org/AVG-1790	38.0.0
2026-04-01T18:26:47.060550+00:00	Arch Linux Importer	Affected by	VCID-yy95-yypj-cqbh	https://security.archlinux.org/AVG-1790	38.0.0
2026-04-01T18:26:47.037274+00:00	Arch Linux Importer	Affected by	VCID-un8e-mz4v-t7ea	https://security.archlinux.org/AVG-1790	38.0.0
2026-04-01T18:25:38.177054+00:00	Arch Linux Importer	Fixing	VCID-kk9k-mpvr-7kh9	https://security.archlinux.org/AVG-1729	38.0.0
2026-04-01T18:25:38.155409+00:00	Arch Linux Importer	Fixing	VCID-gjvm-8v8y-d7c5	https://security.archlinux.org/AVG-1729	38.0.0
2026-04-01T18:25:38.135048+00:00	Arch Linux Importer	Fixing	VCID-a2x3-x693-gqdf	https://security.archlinux.org/AVG-1729	38.0.0
2026-04-01T18:25:38.111820+00:00	Arch Linux Importer	Fixing	VCID-uv8b-n94e-budc	https://security.archlinux.org/AVG-1729	38.0.0